---
title: "oz0 change"
description: "Widening what a tenant's sandboxes may reach is a reviewed change."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/change"
---
# oz0 change

> Widening what a tenant's sandboxes may reach is a reviewed change.

For: Operators and developers looking up a command.

Widening what a tenant's sandboxes may reach is a reviewed change.

A new tenant egress list
(oz0 tenant egress, oz0 egress learn --apply), a plugin install or update whose egress the tenant does not permit yet,
or a credential binding that allows anything the tenant did not, waits as a change request with its delta: each entry
that widens, and what kind of widening it is (a new host, a wildcard, an internal or metadata address, an IP address,
raw TCP, a removed deny entry, a host with a credential bound to it).

A narrowing, or something the tenant permits
already, applies at once. A tenant admin approves the delta they saw, or rejects it; under the tenant's
review-widening second_admin, an admin other than the requester approves. Every step is in the audit log
(egress.change_requested, egress.change_approved, egress.change_rejected, egress.change_applied).

## Usage

```bash
oz0 change [command]
```

## Subcommands

- [`approve`](https://docs.oz0.ai/reference/cli/oz0/change/approve)
- [`list`](https://docs.oz0.ai/reference/cli/oz0/change/list)
- [`reject`](https://docs.oz0.ai/reference/cli/oz0/change/reject)
- [`show`](https://docs.oz0.ai/reference/cli/oz0/change/show)

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.